Unconditional security of coherent-state quantum key distribution with strong 

phase-reference pulse 
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We prove the unconditional security of a quantum key distribution protocol in which bit values 
are encoded in the phase of a weak coherent-state pulse relative to a strong reference pulse. In 
contrast to implementations in which a weak pulse is used as a substitute for a single-photon source, 
the achievable key rate is found to decrease only linearly with the transmission of the channel. 
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Quantum key distribution provides a way to distribute 
a secret key between two distant parties, Alice and Bob, 
even if the quantum channel between them suffers from 
small noises. As long as the law of quantum mechanics 
is valid, an eavesdropper, Eve, cannot force Alice and 
Bob to accept a key on which she has a nonnegligible 
amount of information. A proof of such unconditional 
security was first provided by Mayers ll| for the BB84 
protocol 0, followed by other proofs 0, S S S 0, H • 
While a perfect single-photon source is assumed in the 
earlier proofs, recent proofs [fj, |fj] cover the use of a weak 
laser pulse in a coherent state as a substitute for a single 
photon. This is good news in the practical point of view, 
but comes with a price: the multiphoton components 
of the weak pulse allow Eve a so-called photon-number 
splitting attack 0, 0] . In order to achieve the security 
under this attack, Alice must lower the amplitude of her 
weak pulse as the loss in the channel increases. As a 
result, there is a bound 01 on the achievable key rate 
which scales as 0(j] 2 ) with channel transmission rj. 

In this paper, we prove an unconditional security of 
a scheme using a weak coherent pulse and achieving a 
rate that scales as 0(t]). The scheme is essentially the 
one proposed by Bennett [Jjj> m which a strong pulse 
is transmitted as a phase reference together with a weak 
pulse containing the bit information in the relative phase. 
We made a minor modification to introduce a second lo- 
cal oscillator (LO) for Bob. This makes the analysis sim- 
pler, and allows us to assume a realistic threshold detec- 
tor that may be noisy, inefficient, sensitive to multimodes 
of light, and only discriminates the vacuum from one or 
more photons. 

The scheme is depicted in Fig. Qfa). Suppose that 
Alice's LO emits a strong pulse in a coherent state with 
complex amplitude \oto \e^ A . Using an asymmetric beam- 
splitter (BS1), Alice extracts a weak pulse with very 
small amplitude a = \a\e l< ^ A , and encodes a randomly 
chosen bit value or 1 by applying phase shift or n, re- 
sulting in state \a) or | — a), respectively. Together with 
this signal, she sends the strong pulse from the other 
output of BS1 to Bob as a phase reference. 

On the receiver's side, Bob chooses randomly a bit 
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FIG. 1: (a) A scheme with a strong reference pulse, (b) An 
equivalent scheme except that Eve's region is extended. 



value or 1, and applies phase shift or it to the weak 
signal pulse, respectively. Instead of using the reference 
pulse from Alice directly, Bob uses another LO and tries 
to lock its phase to Alice's one. Suppose that Bob's LO 
produces a strong pulse with complex amplitude |/9o|e l ^ B • 
Combining a potion of this pulse and the reference pulse 
from Alice, he conducts a series of interference experi- 
ments (M) to infer the phase difference 4>a — <\>b- He 
then applies a phase shift equal to this estimated value 
<\>* to his LO, and mixes it with the weak signal from Al- 
ice at BS2. The mixed signal is measured by a threshold 
detector, which gives a "click" whenever it receives one 
or more photons. Bob reports the outcome of the detec- 
tor to Alice over an authenticated public channel. The 
click implies a conclusive result, and both parties accept 
their bits. No click implies an inconclusive result, and 
they discard the bits. 

The security analysis in this paper is valid even if LOs 
with phases 4>a and 4>b are available to Eve. Then, the 
reference pulse from Alice gives no information to Eve. 
The only effect of Eve's attack on this pulse is to disturb 
the measurement outcome (f>* to be deviated from the 
desired value, as (j>* — cf>A — 4>b — A0. But exactly the 
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same effect can be obtained by just applying the phase 
shift A(j> to the weak signal from Alice (Eve may simu- 
late M by herself). Hence we can safely assume that Eve 
simply ignores the strong reference pulse. Similarly, any 
imperfection in the estimation process M, including the 
fundamental limitation arising from finiteness of the am- 
plitudes of the two LOs, has the same effect as introduc- 
ing a noise source applying a phase shift A(f> on the weak 
signal while assuming a perfect estimation, 4>* — 4>A—<f>B- 

The major imperfections in the detector can be treated 
as follows. Suppose that the quantum efficiency of 
the detector is tjd, the transmission coefficient of BS2 
is rjBS2, and the amplitude of LO incident on BS2 is 
(1 — ?7BS2) _1 %) Then, the same measurement can 
be implemented by inserting a lossy medium (BS3) with 
transmission ?7BS2?7Df?o" 1 j then mixing LO with amplitude 
(1 — 770 ) 1 /? by a beamsplitter BS4 with transmission 770, 
followed by a detector with unit efficiency. Here we take 
the limit of r]o — > 1. The dark counting of the detector 
or the detection of stray photons can be simulated by a 
device (P) that inserts a photon in a mode that is orthog- 
onal to the modes of the LOs. We thus finally arrive at 
a scheme with an ideal threshold detector and a locked 
pair of LOs, as in Fig.^b). In this figure, the region ac- 
cessible by Eve is extended for the sake of simplicity. If 
a protocol is secure with this scheme, the same protocol 
implemented by the scheme in Fig. da) is also secure. 

Bob's decision process in the scheme in Fig. ^b) can 
be regarded as a generalized measurement on the light 
entering his site with three outcomes, 0,1, and 2, where 
the last one means "inconclusive" . Let Hb = Ho ® H\ ® 
■ • • ® H v ® • • • be the Hilbert space for the light modes 
received by Bob that are sensible by the detector. The 
mode v = represents the pulse mode of Bob's LO, and 
the modes with v > 1 are orthogonal to it. Let us write 
the coherent state |/3)o|0)i|0)2 ■ ■ ■ simply as \(3). Then, 
the generalized measurement is described by the POVM 
{F ,F l ,F 2 }, where 

F = (1 - I - /3)(-/3|)/2, F 1 = (1 - |/3)</3|)/2, 

and F2 = 1 — Fq — F\ . If everything is ideal except for the 
transmission rj in the channel, Alice's signal is received 
by Bob in coherent states | ± */?j"a), and they can agree 
on a key without errors by choosing (3 — ^frja. 

Before describing the proof of unconditional security, 
we introduce several notations. We decompose Hb as 
Hb = ICb (5 Hex, where Kb is the two-dimensional sub- 
space spanned by \(3) and | — (5). We assume a and 
to be real and positive without loss of generality. Let 
{|/ i /)s};=i,2,... be an arbitrary complete orthonormal ba- 
sis for H cx . We identify Kb as a qubit, and define 
its X basis as {\0 X ) B = (\/3) + | - /9»/(2 C/9 ), \1 X ) B = 

- 1 - 0»/(2*/j)}> where H - 1 = 1 - 2 4 = 

{—(3\(3) = e 2 1 ^ I . The Z-basis states are denoted as 
\3z)b = (|Q b )b + (-l) J '|l K )fl)/V2 (j = 0,1). For Al- 
ice's side, we denote by Ha the Hilbert space of the light 



modes emitted from her site. We also introduce an aux- 
iliary qubit in Alice's site, with Hilbert space ICa- We 
denote the X- and the Z-basis states as \] x )a and \j z )a 
(j = 0,1). We sometimes denote the projection | ( E > )( < E > | 
asP(|$». 

The key idea in the security proof is a trace- 
nonincreasing completely positive map, which is speci- 
fied by Kraus operators Aj : Hb —* ICb (j = 0, 1, 2, . . .) 
defined by A = s \O x ) B (O x \ + c^|l x ) B (l x | for j = and 
Aj = \0 x )B(^j \ otherwise. Since J2j AjAj < 1, there ex- 
ists a filter with the following property. It takes any state 
p acting ouHb as an input, and it accepts with proba- 
bility p = J^j Tr(A-Ajp) while it rejects with probability 
1 — p. Whenever it accepts, it returns the output state 
J2j AjpA*j/p acting on ICb- This filter is related to the 
POVM {F ,F U F 2 } by 

F k = J2A]\k z )B(k z \Aj (1) 
j 

for k = 0,1, which is easily confirmed. This rela- 
tion implies that we can implement the measurement 
{F , Fi, F 2 } by applying the filter and conducting Z-basis 
measurement on the output state when it accepts (if it 
rejects, we assume that the outcome is "2"). 

With the above decomposition of Bob's measurement, 
we can prove the unconditional security by a method sim- 
ilar to the cases of qubit-based B92 protocols 0, @| • We 
introduce a protocol based on entanglement distillation 
[l2|. which is later shown to be equivalent to the real 
protocol. In the new protocol, (1) Alice prepares state 
(\0 Z ) A \u) + \l z ) a\~ a)) / 011 1Ca<&Ha- We assume that 
Alice produces 2N copies of this state. (2) Eve receives 
27V pulses (corresponding to 7i^f 2Ar ) from Alice, and pre- 
pares a state on H% 2N , which may be entangled to Eve's 
system. (3) After Bob has received 27V pulses (corre- 
sponding to H B 2N ), Alice and Bob randomly permutate 
the order of 27V pairs of systems by public discussion. (4) 
For the first TV pairs (check pairs), Alice measures each 
qubit (ICa) on Z basis, and Bob performs the POVM 
{Fo,Fi,F 2 } on each pulse (Hb)- They disclose all the 
results, and learn the number n err of error events where 
the combination of Alice's and Bob's outcomes are (0, 1) 
or (1,0). (5) For the other TV pairs (data pairs), Bob 
applies the above filter to each pulse, and discloses each 
result (accept or reject). Let nfii be the number of events 
where the filter has accepted. (6) Alice and Bob now have 
Ufa pairs of qubits (ICa <X> ICb ) , from which they try to ex- 
tract a number of pairs in the maximally entangled state 
(\0 z )a\0 z )b + \I z )a\I z )b)/V2. To do so, they estimate 
the number ribit of pairs with a bit error (represented by 
the subspace spanned by {\0 z )a\^ z )b,\ 1 z)a\0 z )b}) and 
the number rt p h of pairs with a phase error (the sub- 
space spanned by {|0 x )a|1s)b, |1x)a|0 x )b}), horn the 
knowledge of rifn and n crr . If neither number of errors 
is too high, they run an entanglement distillation proto- 
col (EDP) and then measure on Z basis to determine the 
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final key. As in the proof of BB84 |4| , if the estimation 
of the upper bounds for rtbit and n p h is correct except 
for a probability that becomes exponentially small as TV 
increases, this protocol is essentially secure. 

According to the argument by Shor and Preskill [4J, 
if we choose an appropriate EDP scheme, Alice and Bob 
can conduct Z-basis measurement on the ngi pairs imme- 
diately after step (5) and decide the final key by a pub- 
lic discussion without compromising the security. Then, 
Eq. shows that Bob's measurement on each data qubit 
is also the POVM {Fo, Fi, F2}. Alice's measurement can 
be further brought forward to the end of step (1), then 
this step is equivalent to just preparing state |a) or | — a) 
randomly. The new protocol is thus equivalent to the 
prepare-measure protocol implemented as in Fig.njb). 

The remaining task for the security proof is to estab- 
lish an exponentially good way of estimating nt>it and 
7i p h- Since n crl and ?ibit are the results of the same mea- 
surement applied to the (randomly assigned) check pairs 
and to the data pairs, we can apply a classical probability 
estimate to see that |nbit — n CII \ < Ne holds except for 
a small probability which is asymptotically smaller than 
~ exp(— Ne 2 ). The estimation of n p h can be done by 
considering what could have happened if Alice and Bob 
measured their ngi pairs of data qubits in X basis and 
determined n p h by discussion, just after the step (5). In 
this scenario, they obtain three numbers (rifn, fi p h, ^crr)- 
The following argument shows that some combinations 
of (rifii, n p h, n crr ) are exponentially rare for any attack 
by Eve, and hence gives an (exponentially reliable) up- 
per bound n p h(nfii, n err ) for function of the other 
two. 

We can regard n p h as the number of events 
where a measurement on JCa ® Kb produced the 
outcome corresponding to the element of a POVM 
Af ph = J2j P(\Qx)a) ® A)\l x ) B {l x \A + P(\1 X ) A ) ® 

A]\0 x ) B (0 x \Aj = s\P{%)a\%)b) + c}P(\O x ) A \l x ) B ) + 
P(\^x)a) ® lex- Similarly, rim corresponds to Mm 
I 1 <8> Ej^Aj = 1 A <g> {c}P{\l x ) B ) + s 2 P(\0 x ) B ) + 
l cx ). From these forms, we notice that n p h and 
nfii are also obtained by the projection measurement 
{Poo, Pii,Pio,Poi,P(\Qx)A)®l e x, P(\l x ) A )®l e x}, where 
Pij = P(\i x )A\j x )B), followed by a classical proce- 
dure composed of Bernoulli trials. If we denote the 
results of the N projection measurements as {n+(l — 
(5+), n + 5 + , n_ (1 — <5_), mo, mi} in the same order, 

these numbers should be related to n p h and nm as 

\n ph -mi-n^[s 2 {l-S-)+c 2 S-}\ < Ne (2) 
\n&\ — mo — mi — Cp(n + 5 + + ?i_<5_) 

-s}[(n + (l-5 + )+n.(l-S.)}\ < Ne (3) 

with probability at least 1 — exp(2Ae 2 ). Since the 
marginal state pa on JCa cannot be altered by Eve, the 
A-basis measurement on JCa is another Bernoulli trial. 
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FIG. 2: Key gain G is positive in the region between the 
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two solid curves, (a) |a| 2 = 0.5, r) = 0.01, (b) \a\ 2 
77 = 0.01. 

Since p A = c 2 a P(\0 x ) A ) + 4 P(\1 x )a), we have 
|mi + n + 5 + +n_(l - £_) - s 2 a N\ < Ne. 



For the check pairs, n crr corresponds to M c „ = 
P{\0z)a) ® Fi + P(\1 Z ) A ) ® F = (l/2)[P(|r u )) + 
P(|roi)) + 1a ® l C x], where we have introduced a ba- 
sis {|r.y)} lJ= o,i of JCa ® K-b by |r y ) = cp\i x ) A \j x ) B - 
(— - i) x ) A \{^ - ])x)b- It implies that n crr could 
also be obtained by the global projection measurement 
{Qoo,Qii,Qio,Qoi, 1a® lex}, where Qij = P(|I\,')), fol- 
lowed by Bernoulli trials. If we write the results of N 
projection measurements as {n',(l — S',), n',6',, n'_{l — 
6'_), n'_8'_, m}, we obtain 

|n err - (n' + 5' + + n'_5'_ + m)/2| < Ne. 

If we compare the projection measurements on the 
data pairs and the check pairs, we further notice that 
n + and n' + are the results of an identical measure- 
ment, namely, projection onto the space TL+ spanned 
by {\0 x )a\0 x )b,\1 x )a\1 x )b}- We can thus apply the 
classical probability estimate. <5+ and 8', comes from 
projection to nonorthogonal states. For such a case, 
it was shown [jj that combination (<5+,<5(|_) is exponen- 
tially rare unless there exists a state p on H+ satisfying 
Tr[pP(\l x ) A \l x ) B )] = 6+ and Tr[pP(\T n ))] = 5' + . Using 
these arguments, we obtain 

|n±-r4| < Ne, 



S± > cf 3 S± + S |(l - 5 ± ) - 2c p spy/6 ± (l-6±)- e'. 

We are interested in the secret key gain in the limit 
N — > 00. Setting e and e' to be zero, we obtain 
2n crr > nsi - Zcpsp [71+ yj 5+(l - 5+) + n_ y/ 5-{\ - 6-)]. 
Then we can eliminate n± and 5± to be left with two free 
parameters mo and mi. From this point, in general, we 
may have to numerically minimize n eTI over the two pa- 
rameters. It turned out that in most of interesting cases 
mo = mi = gives the minimum. Once we obtain the 
minimum of n orr as a function of (n p hj ^fli), we can deter- 
mine fi v h(n&h n eir)- The length of the final key is given 
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HE| by n koy (n fil ,n OIT ) = n m [l-h(n cri ./n m )-h(n ph /n m )} 
when this value is nonnegative and 2n p h < nm- 

Figure [21 shows the parameter region (nm,n eir ) where 
the key gain G = n koy /A is positive, for a few choices of 
a and j3 = Jfj(X- When Alice chooses \a\ 2 = 0.5, the tol- 
erable error rate n eTI /nfn is less than 1%. For a smaller 
amplitude \a\ 2 = 0.001, the tolerable rate increases to 
~ 7%. Choosing a smaller value for \a\ 2 than this ex- 
ample does not improve the tolerable rate significantly. 
For either case in Fig. taking a smaller value of r\ gives 
little change in the shape of region, except for the normal- 
ization factor in the abscissa rimo = N(l — e 4ri ^ )/2 ~ 
2ri\a\ 2 N. This allows us to choose a fixed \a\ 2 in the limit 
of 77 — ► as long as n mr /nni is fixed, leading to the key 
gain G proportional to 77. 

In Fig. E£b) i we notice that the region extends far into 
the area with high n crl /nfn and nm, but ordinary sources 
of errors never achieve this region. For example, Errors 
in phase [A(f> in Fig. QJb)] result in curve B. Errors by 
spurious countings [device P in Fig. ^b)] , which is mod- 
eled as nfii = NX + (1 — A)ngio and n CII = NX/2, follow 
curve A. 

In order to achieve a high key gain, we can optimize 
over | ck| 2 for a given model of errors. Here we assume 
that all errors are spurious countings (curve A), and take 
A = 7+l-exp{-|a| 2 r/[4C/(l-2C)]}. The first term is the 
contribution independent of \a\ 2 , such as the dark count- 
ing rate of the detector. The rest represents "misalign- 
ment errors" , which are caused by a stray light propor- 
tional to the strength of LO. A mode mismatch between 
Alice's and Bob's LO is an example of this type of errors. 
We chose the parameter £ such that ri C rr/^fii - * C f° r 
77 — s- when 7 = 0. Assuming this model, we optimized 
G over \a\ 2 , which is shown in Fig. [3] For 7 = £ = 
[curve (a)], the key gain decreases as G ~ 0{rf), which 
should be compared to the 0(r] 2 ) decrease in the case 
H where a coherent-state source is simply substituted 
for a single-photon source in BB84 [curve (d)]. When 77 
is small, the optimal choice is |a| 2 ~ 0.23, which gives 
nai/N ~ 0.91(?7/2). The raw key is shorten by factor 
~ 0.69, leading to G ~ 0.29(77/2). This value is smaller 
than the ideal BB84 G = r//2 [curve (c)] by a constant 
factor. If we include a small alignment error (£ = 3%), 
the key rate drops by a constant factor but the 0(rf) 
dependence remains [curve (b)]. This tendency contin- 
ues up to £ ~ 7.6%, at which the key gain is zero for 
any value of |a| 2 . Finally, if we include a contribution 
of dark counting 7, each curve drops to zero when the 
overall counting rate is comparable to 7. 

In summary, we have shown that by encoding on the 
phase of a weak coherent pulse relative to a strong ref- 
erence pulse, we can achieve a key rate of 0(77) with 
unconditional security, which is an advantage over the 
coherent-state BB84. There are several proposals 0] 
to improve the performance of the coherent-state BB84, 



and their unconditional security is an interesting prob- 




0.5 1 1.5 2 2.5 3 3.5 



logio/7 



FIG. 3: Key gain G versus transmission 77. (a) £ = 7 = 0. 
(b) £ = 3%, 7 = 0. (c) BB84 with an ideal single-photon 
source for no errors, (d) BB84 with a coherent-state source 
for no errors, (a')-(d'): The same except for inclusion of dark 
counting rate 7 = 10 -4 . 



lcm. The security of the original B92, which uses only 
one LO, is also interesting since the relation between the 
amplitude of the reference pulse and the security will 
show up more tightly. 

The author thanks N. Imoto, H.-K. Lo, D. Mayers, 
J. Preskill, K. Tamaki, and especially N. Lutkenhaus for 
helpful discussions. 
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